Re: [secdir] [v6ops] Secdir telechat review of draft-ietf-v6ops-transition-ipv4aas-12

Christian Huitema <huitema@huitema.net> Mon, 07 January 2019 18:02 UTC

Return-Path: <huitema@huitema.net>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DBC00130EC6 for <secdir@ietfa.amsl.com>; Mon, 7 Jan 2019 10:02:40 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.601
X-Spam-Level:
X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B7EVxi0aSOdP for <secdir@ietfa.amsl.com>; Mon, 7 Jan 2019 10:02:38 -0800 (PST)
Received: from mx43-out1.antispamcloud.com (mx43-out1.antispamcloud.com [138.201.61.189]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C36B41277BB for <secdir@ietf.org>; Mon, 7 Jan 2019 10:02:37 -0800 (PST)
Received: from xsmtp01.mail2web.com ([168.144.250.230]) by mx66.antispamcloud.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.89) (envelope-from <huitema@huitema.net>) id 1ggZEP-0001jA-Fm for secdir@ietf.org; Mon, 07 Jan 2019 19:02:35 +0100
Received: from [10.5.2.14] (helo=xmail04.myhosting.com) by xsmtp01.mail2web.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from <huitema@huitema.net>) id 1ggZEH-0004WS-1a for secdir@ietf.org; Mon, 07 Jan 2019 13:02:29 -0500
Received: (qmail 6632 invoked from network); 7 Jan 2019 18:02:21 -0000
Received: from unknown (HELO [192.168.1.101]) (Authenticated-user:_huitema@huitema.net@[172.56.42.39]) (envelope-sender <huitema@huitema.net>) by xmail04.myhosting.com (qmail-ldap-1.03) with ESMTPA for <secdir@ietf.org>; 7 Jan 2019 18:02:21 -0000
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (1.0)
From: Christian Huitema <huitema@huitema.net>
X-Mailer: iPhone Mail (16C101)
In-Reply-To: <8E63971A-FEB2-4AB4-BED5-0FEBC8D6949D@consulintel.es>
Date: Mon, 7 Jan 2019 10:02:19 -0800
Cc: secdir@ietf.org, v6ops@ietf.org, ietf@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <B0031737-005E-4AF9-9C0C-4A2A5774F73C@huitema.net>
References: <154684244329.17044.2866311660755291596@ietfa.amsl.com> <CD5A6FC1-77A1-42F8-83F6-86581F11E838@consulintel.es> <8E63971A-FEB2-4AB4-BED5-0FEBC8D6949D@consulintel.es>
To: JORDI PALET MARTINEZ <jordi.palet@consulintel.es>
X-Originating-IP: 168.144.250.230
X-Spampanel-Domain: xsmtpout.mail2web.com
X-Spampanel-Username: 168.144.250.0/24
Authentication-Results: antispamcloud.com; auth=pass smtp.auth=168.144.250.0/24@xsmtpout.mail2web.com
X-Spampanel-Outgoing-Class: unsure
X-Spampanel-Outgoing-Evidence: Combined (0.23)
X-Recommended-Action: accept
X-Filter-ID: EX5BVjFpneJeBchSMxfU5jHkVeuB2ZXQ1iguQK3r7Pt602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx q3u0UDjvOzniiMFxnOFMHTZqw+apvQzTV/3OdXD2Xdo8CfrY5CQS7yDa+vCBJ0/aDVBkmz2qAIyz NJVaeAWax4WOe4pTBX2DwIE7VKe+bqpcdCns72R1myoI6HG8RgZGnUdJnKT7IqXe0Of4jddu9xC8 8+iQ5nb6BRFVjXUbiREH8mlR1JtPfYZ1V10x8j0kNETJD+nyXtcV2Hz37FuQUlYMDMlHwjIJ0464 etNXHOU+5Kb0QuG3bATPP9eeLWC5kDweN7crsXBXvrLBlKCVRjjdPbjQ4HmidG0pg2HLuLsP3mPp isElTs5Ex5aNZlcgVQFtAhrEij3dKxLhoxcmaInYbR5vlqETd+klAX+KFYkIxu6zxdn+1QmdZsu6 kxo/qWEj6Z1d7VIcMSgqtcKbU9La+AHiCFB9vuYMeDoXsMJDD9CZFW2DHXeua4usuyudZl7ZJWmg 5a0jiD6XqsJZtjQxlyCdsewzRmhoeKlCpofGlp99T8RpJ5xYPZNRoOw1IxzkiGadCrr1g0oxQ4Hx 9ZbEd6A0pApl7B1QQuoPmRqW5R/J2U16th3iHXgtR+Y1L+Zzkg9a2/EwurjXBahe19+jBD7VuIee yrhzWminYO4gRGXn3bDVvCoqfGflxbtjudA02/m3s27IkHT4SMXRhQ/EkhkuGAO4aeVKjbQuc4NX lvv7E2xuaQzHYV6GCBsvo7Vn8xH1W6M5+kaZuEXO0wMN9NIDORBy2DNwOgV373pfDhBQ21OdM8gu ipSMnc4a1vOLkZpIf7UyEpcn4vR70ZwyprD5IJ34YaYZ30wD+IYKdMuYOSaM5ZxrRnRt4PqMzH3k 7hTkr8kPb2KLnZ2Xht3zA75VehhIcJfl9xjKxh+F8kIXLdZND3rjHB4Yc+TqdazcMI41sA2AfTJ2 5W/vzfaHf3wr2m4mbmeTgFKBgc4kmBS2brusOVZrHRzE6blhEo+mN1j1Fw==
X-Report-Abuse-To: spam@quarantine9.antispamcloud.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/b5egnR8tZqHVg-lAFDAA9ousGVk>
Subject: Re: [secdir] [v6ops] Secdir telechat review of draft-ietf-v6ops-transition-ipv4aas-12
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 07 Jan 2019 18:02:41 -0000

Yes, that would work fine. If it could help convince these routers to implement DHCP guard or RA guard, that would be a great result.

I am not so sure about 802.1x. The routers could of course support a setting like that of the IETF network, and that would have some advantage over WPA residential, but it would not address an important threat: local device compromised by some virus and engaging in DHCP spoofing. DHCP guard or RA guard would still be needed.

-- Christian Huitema 

> On Jan 7, 2019, at 2:38 AM, JORDI PALET MARTINEZ <jordi.palet@consulintel.es>; wrote:
> 
> Hi Christian,
> 
> I've drafted this at the moment. Let me know if you think now this is better and if you think anything else is needed.
> 
> 8.  Security Considerations
> 
>   The IPv6 Transition CE Router must comply with the Security
>   Considerations as stated in [RFC7084], as well as those stated by
>   each transition mechanism implemented by the IPv6 Transition CE
>   Router.
> 
>   As described in [RFC8026] and [RFC8415] Security Consideration
>   sections, there are generic DHCP security issues, which in the case
>   of this document means that malicious nodes may alter the priority of
>   the transition mechanisms.
> 
>   Considering that, networks using DHCPv6, depending on their specific
>   topologies, should consider using authentication mechanisms such as
>   those based on IEEE-802.1X or access control mechanisms such as DHCP
>   snooping, DHCP guard, or TR-069, among other possible choices.
> 
>   As stated in the introduction, this document addresses deployment of
>   IPv4aaS in residential, SOHO and SME networks.  Deployment in more
>   challenging environments would require additional security analysis.
> 
> 
> Regards,
> Jordi
> 
> 
> 
> -----Mensaje original-----
> De: ietf <ietf-bounces@ietf.org>; en nombre de JORDI PALET MARTINEZ <jordi.palet=40consulintel.es@dmarc.ietf.org>;
> Fecha: lunes, 7 de enero de 2019, 11:17
> Para: Christian Huitema <huitema@huitema.net>;, <secdir@ietf.org>;
> CC: <v6ops@ietf.org>;, <ietf@ietf.org>;
> Asunto: Re: [v6ops] Secdir telechat review of draft-ietf-v6ops-transition-ipv4aas-12
> 
>    Hi Christian,
> 
>    Thanks for your review.
> 
>    There is a typo there, wrong copy and paste. It should be RFC8415 and RFC8026, as we discussed after your review.
> 
>    My point, as discussed in the previous email exchange, is that this is a generic issue of DHCP. DHCP is used by both residential and non-residential service provisioning, and I don't see how we can solve that problem unless we implement some new DHCP "extension" that apply end-to-end encryption between, in this case, the CEs and the servers.
> 
>    I can have a security section with basically replicates the text available in RFC8415 Security Section, including considerations of using IEEE-802.1X, DHCP snooping/guard/access control mechanisms, use of TR-069 access control mechanisms, etc.
> 
>    I'm also happy to add your suggested paragraph regarding additional security analysis in more challenging environments.
> 
>    Or maybe the correction of the RFC8415 references is sufficient in your opinion or you will prefer some additional text to summarize the RFC8415 security considerations/mitigations?
> 
>    I'm going to wait a couple of days, in case there are further inputs, before uploading a new version correcting the mistake and also take in considerations the suggestions from the Gen-ART review a couple of days ago.
> 
>    Regards,
>    Jordi
> 
> 
> 
>    -----Mensaje original-----
>    De: v6ops <v6ops-bounces@ietf.org>; en nombre de Christian Huitema <huitema@huitema.net>;
>    Fecha: lunes, 7 de enero de 2019, 7:28
>    Para: <secdir@ietf.org>;
>    CC: <v6ops@ietf.org>;, <ietf@ietf.org>;, <draft-ietf-v6ops-transition-ipv4aas..all@ietf.org>;
>    Asunto: [v6ops] Secdir telechat review of draft-ietf-v6ops-transition-ipv4aas-12
> 
>        Reviewer: Christian Huitema
>        Review result: Ready
> 
>        I already reviewed the version 11 of this draft. From a security point of view,
>        the main change between the two versions is the addition of a paragraph
>        acknowledging the potential risks of relying on DHCP for configuration. To
>        quote: "As described in [RFC8026] and [RFC8026] Security Consideration
>        sections, there are generic DHCP security issues, which in the case of this
>        document means that malicious nodes may alter the priority of the transition
>        mechanisms."
> 
>        Well, on the one hand, this does directly address the point I raised in the
>        previous review. On the other hand, it is a bit sad to have a dry
>        acknowledgement like that, without any hint at mitigations. If I was writing an
>        April's fool RFC, I would qualify that as one of those security sections that
>        seem written primarily for appeasing the security reviewer. But then, do we
>        want to give some advice to implementers? For example, do we want to tell them
>        that it is OK to deploy compliant devices in a basic home network? Probably. In
>        the branch office of a financial institution? Most probably not. Do we have a
>        way to convey that in simple terms? I would add something like:
> 
>        "As stated in the introduction, this document addresses deployment of IPv4 as a
>        service in a residential or small-office network. Deployment in more
>        challenging environments would require additional security analysis."
> 
> 
>        _______________________________________________
>        v6ops mailing list
>        v6ops@ietf.org
>        https://www.ietf.org/mailman/listinfo/v6ops
> 
> 
> 
> 
>    **********************************************
>    IPv4 is over
>    Are you ready for the new Internet ?
>    http://www.theipv6company.com
>    The IPv6 Company
> 
>    This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
> 
> 
> 
> 
> 
> 
> 
> **********************************************
> IPv4 is over
> Are you ready for the new Internet ?
> http://www.theipv6company.com
> The IPv6 Company
> 
> This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
> 
> 
>